EnergyMindAI

By Saad Iqbal

Five Years, Undetected

For five years, an intruder sat inside the operational network of a US critical infrastructure provider. It didn’t smash through firewalls or drop obvious malware. It logged in the way an engineer would: through legitimate administrator tools, native system commands, and credentials it had quietly harvested along the way. Investigators call this technique “living off the land,” and it’s why the campaign, attributed by CISA, the NSA, and the FBI to a Chinese state-sponsored group known as Volt Typhoon, went unnoticed for so long. The target wasn’t data. It was position — a foothold inside the systems that keep power flowing, water treated, and pipelines pressurized, held in reserve for some future crisis.

That single case is why, this year, CISA and allied cybersecurity agencies in Australia, the UK, and Canada issued new guidance asking energy and infrastructure operators to do something that sounds almost primitive in the AI era: pre-plan how to physically unplug their control systems from the internet and keep the lights on anyway, for weeks at a time. It’s a strange kind of progress — the most advanced grids in the world preparing to run like it’s 1995, on purpose, because the alternative is running blind while state-sponsored actors move undetected in the shadows of their own networks.

That’s the paradox energy engineers now sit inside. The same AI wave reshaping how we forecast demand and model reservoirs is also the tool both sides are racing to weaponize — attackers using it to blend in faster, defenders using it to spot the one anomalous login among ten million routine ones. Below are five AI-powered tools actually deployed in energy and industrial environments to fight that second half of the battle, what they’re verified to do well, and where their limits sit.

Why Traditional OT Security Falls Short

Operational technology networks — the SCADA systems, programmable logic controllers, and sensors that actually run a substation or a compressor station — were built for reliability, not for defense against modern adversaries. Many run protocols decades old, can’t tolerate a security agent slowing them down, and can’t simply be patched on Microsoft’s schedule without risking downtime that costs real money and, in the worst case, real safety margins.

Traditional IT security tools, tuned for office networks, tend to either miss OT-specific threats entirely or throw so many false alarms that operators start ignoring them. That gap is exactly where a new generation of AI-driven OT security platforms has moved in — not by bolting antivirus onto a turbine controller, but by passively learning what “normal” looks like across thousands of industrial devices and flagging the deviations a human analyst would take weeks to notice, if they noticed at all.

Five AI Security Tools Energy Engineers Are Actually Using

Dragos Platform

Dragos built its platform specifically for industrial environments, with a threat-intelligence practice that tracks more than 100 ransomware groups actively targeting industrial organizations — a level of OT-specific focus that generalist security vendors don’t match. For energy and utility operators, Dragos combines asset visibility with detection logic built from real incident response work inside power, oil and gas, and manufacturing environments, rather than adapted IT signatures. It’s aimed squarely at the “purpose-built OT detection” niche: knowing the difference between a technician running a legitimate diagnostic and an attacker probing the same protocol.

Claroty Platform

Claroty’s research arm, Team82, has disclosed more than 550 vulnerabilities in cyber-physical systems, and that research feeds directly back into its platform’s asset discovery and risk-scoring engine. For an energy engineer, the practical value is depth: Claroty is built to map not just what’s on the network, but exactly how exposed each asset is, which matters enormously when you can’t take a transformer offline just to patch it. It’s a strong fit for operators who need granular, asset-by-asset risk context rather than a single “threat detected” alert.

Nozomi Networks

Nozomi’s platform leans hardest into AI-powered anomaly detection at scale, with visibility reportedly extending across roughly 115 million OT and IoT assets globally. The pitch is straightforward: train a model on what normal traffic looks like across a compressor station or substation, then surface the pattern that doesn’t fit — a PLC suddenly talking to an address it’s never contacted before, or a command sequence issued at 3 a.m. that historically only runs at shift change. For engineers managing large, distributed asset fleets, that scale of pattern-learning is the main draw.

Tenable OT Security

Tenable’s OT product leans into the compliance side of the job, with monitoring built around NERC CIP requirements — the mandatory reliability standards that govern how North American utilities secure their bulk power systems. For an engineer who has to answer to an auditor as much as to an incident responder, that’s a meaningful distinction: fewer generic alerts, more mapping of vulnerabilities directly to the regulatory framework the utility already has to report against.

Darktrace / OT

Darktrace’s approach, per its own security leadership, centers on passive anomaly detection specifically because fragile ICS networks can’t tolerate active scanning that risks disrupting a live process. The AI learns the operational rhythm of a plant or grid segment over time and flags deviations without injecting traffic into systems where an unplanned hiccup could mean a real-world safety event. It’s a philosophy worth noting regardless of which vendor an engineer ultimately chooses: in OT, watching carefully beats poking around.

What AI Security Tools Can’t Do Yet

None of this is a substitute for basic hygiene, and the vendors themselves are candid about it. Anomaly detection tells you something unusual happened — it doesn’t by itself fix a supply-chain vulnerability sitting in firmware that shipped from a vendor five years ago, or validate that the code running on a controller hasn’t been tampered with upstream. Security researchers have also flagged a harder truth: adversaries are using AI too, for reconnaissance and for blending malicious activity into normal traffic patterns, which is precisely the kind of behavior anomaly-detection models are weakest against when the “abnormal” action is deliberately engineered to look routine.

That’s the real argument behind CISA’s push for tested, physical isolation plans this year. AI-driven detection buys time and visibility, but it doesn’t replace the ability to pull the plug and keep critical services running anyway. The two are meant to work together, not substitute for each other.

Where an Engineer Should Actually Start

If you’re a plant or grid engineer without a dedicated security team, the honest starting point isn’t buying a platform — it’s asset visibility. You cannot defend what you cannot see, and most industrial networks have far more connected devices than anyone realizes, including forgotten remote-access tools installed for a contractor years ago. Every platform above starts there for a reason.

From there, match the tool to the actual constraint: choose Tenable if regulatory reporting is the pain point, Dragos or Claroty if you need OT-specific threat depth, Nozomi if scale across a large distributed fleet is the priority, and lean on a passive-detection philosophy like Darktrace’s wherever the network is too fragile to risk active scanning. None of these choices are mutually exclusive, and none of them are a finish line.

The Volt Typhoon story is really a story about time — five years of quiet presence before anyone noticed. AI-driven detection compresses that window from years to hours in the best case. It won’t compress it to zero. The isolation plans, the tested cutovers, the boring, unglamorous discipline of knowing exactly where your network’s plug is — that’s still the backstop no algorithm replaces. The tools above are how energy engineers buy themselves the time to build it.